Re: [PATCH 2/2] aarch64: Make glibc.mem.tagging SXID_ERASE

[Siddhesh Poyarekar <siddhesh@sourceware.org>]

On 2023-10-05 09:59, Szabolcs Nagy wrote:
> The 10/05/2023 08:55, Siddhesh Poyarekar wrote:
>> On 2023-10-05 04:19, Szabolcs Nagy wrote:
>>> i'd fix this in one place that makes the behaviour easy
>>> to reason about: _dl_next_ld_env_entry in rtld should
>>> just return empty in secure mode and same for getenv,
>>> internally it should return empty.
>>>
>>> then we know that nothing in libc can depend on the env.
>>> (if something parses env directly that should be fixed)
>>>
>>> if anything, there should be a whitelist, not blacklist
>>> of env vars.
>>
>> That won't work because it would require knowledge of (or a mechanism to
>> specify) safety of environment variables used by the application and its
>> children.  The current unsecvars approach is probably the best option.
> 
> why would you need a whitelist of application envvars?
> 
> if there is any env var usage *in libc* that is valid to
> affect setuid binaries then those should be whitelisted.
> (black list works too, but more error prone in imo)

So do you mean (1) maintain a full list of envvars recognized by glibc 
and then (2) designate specific ones as safe?  That would be a good idea.

Sid